@segmentstream/ontology 0.0.0-stage → 0.92.0

package/dist/service/federation-provider.d.ts

@@ -0,0 +1,36 @@
+import { type JWTVerifyGetKey } from "jose";
+/** Pinned issuer discovery is cached; keys are fetched only from its own HTTPS origin. */
+export declare function createFederationProvider(config: {
+    issuer: string;
+    clientId: string;
+    environment?: string;
+    deploymentId?: string;
+    manifestDigest?: string;
+}, options?: {
+    fetch?: typeof fetch;
+    keySet?: JWTVerifyGetKey;
+}): {
+    metadata: () => Promise<{
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+    }>;
+    exchange: (input: {
+        code: string;
+        verifier: string;
+        redirectUri: string;
+        nonce: string;
+    }) => Promise<{
+        name?: string | undefined;
+        email?: string | undefined;
+        sessionId?: string | undefined;
+        issuer: string;
+        subject: string;
+        clientId: string;
+        generation: number;
+        consentId: string;
+        deploymentId?: string | undefined;
+        environment?: string | undefined;
+        manifestDigest?: string | undefined;
+    }>;
+};

package/dist/service/federation-provider.js

@@ -0,0 +1,110 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+/** Pinned issuer discovery is cached; keys are fetched only from its own HTTPS origin. */
+export function createFederationProvider(config, options = {}) {
+    const fetcher = options.fetch ?? fetch;
+    let discovery;
+    let keys = options.keySet;
+    const metadata = () => (discovery ??= (async () => {
+        const response = await fetcher(`${config.issuer}/.well-known/openid-configuration`, {
+            redirect: "error",
+            signal: AbortSignal.timeout(5000),
+        });
+        const body = (await response.json());
+        if (!response.ok || body.issuer !== config.issuer) {
+            throw new Error("OIDC issuer discovery mismatch");
+        }
+        for (const name of ["authorization_endpoint", "token_endpoint", "jwks_uri"]) {
+            const url = typeof body[name] === "string" ? URL.parse(body[name]) : null;
+            if (!url ||
+                url.protocol !== "https:" ||
+                url.origin !== new URL(config.issuer).origin ||
+                url.username ||
+                url.password ||
+                url.hash) {
+                throw new Error("OIDC discovery endpoint is invalid");
+            }
+        }
+        return body;
+    })().catch((cause) => {
+        discovery = undefined;
+        throw cause;
+    }));
+    return {
+        metadata,
+        exchange: async (input) => {
+            const document = await metadata();
+            const response = await fetcher(document.token_endpoint, {
+                method: "POST",
+                redirect: "error",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                cache: "no-store",
+                signal: AbortSignal.timeout(5000),
+                body: new URLSearchParams({
+                    grant_type: "authorization_code",
+                    client_id: config.clientId,
+                    code: input.code,
+                    code_verifier: input.verifier,
+                    redirect_uri: input.redirectUri,
+                }),
+            });
+            const body = (await response.json());
+            if (!response.ok || typeof body.id_token !== "string") {
+                const explanation = [body.error, body.error_description]
+                    .filter((value) => typeof value === "string")
+                    .join(": ");
+                const diagnostic = [input.code, input.verifier, input.nonce].reduce((text, credential) => (credential ? text.split(credential).join("[redacted]") : text), explanation);
+                throw new Error(`OIDC code exchange failed (${response.status}): ${diagnostic || "no ID token"}`);
+            }
+            keys ??= createRemoteJWKSet(new URL(document.jwks_uri), { timeoutDuration: 5000 });
+            const { payload } = await jwtVerify(body.id_token, keys, {
+                algorithms: ["ES256"],
+                issuer: config.issuer,
+                audience: config.clientId,
+                requiredClaims: ["sub", "nonce", "auth_time", "iat", "exp"],
+                maxTokenAge: 300,
+            });
+            if (payload.aud !== config.clientId) {
+                throw new Error("OIDC ID token audience must be the single public client ID");
+            }
+            if (payload.nonce !== input.nonce) {
+                throw new Error("OIDC ID token nonce does not match this login");
+            }
+            if (!payload.sub ||
+                typeof payload.auth_time !== "number" ||
+                payload.auth_time > payload.iat) {
+                throw new Error("OIDC ID token subject or authentication time is invalid");
+            }
+            if (payload.exp - payload.iat > 300) {
+                throw new Error("OIDC ID token lifetime exceeds five minutes");
+            }
+            if (!Number.isInteger(payload.ss_generation) || typeof payload.ss_consent !== "string") {
+                throw new Error("OIDC ID token lacks the client generation or consent reference");
+            }
+            if (config.environment &&
+                (payload.ss_environment !== config.environment ||
+                    payload.ss_manifest_digest !== config.manifestDigest ||
+                    (config.environment !== "local" && payload.ss_deployment_id !== config.deploymentId))) {
+                throw new Error("OIDC deployment binding mismatch");
+            }
+            return {
+                ...(config.environment
+                    ? {
+                        environment: config.environment,
+                        manifestDigest: config.manifestDigest,
+                        ...(config.deploymentId ? { deploymentId: config.deploymentId } : {}),
+                    }
+                    : {}),
+                issuer: config.issuer,
+                subject: payload.sub,
+                clientId: config.clientId,
+                generation: payload.ss_generation,
+                consentId: payload.ss_consent,
+                ...(typeof payload.ss_session === "string" ? { sessionId: payload.ss_session } : {}),
+                ...(payload.email_verified === true && typeof payload.email === "string"
+                    ? { email: payload.email }
+                    : {}),
+                ...(typeof payload.name === "string" ? { name: payload.name } : {}),
+            };
+        },
+    };
+}

package/dist/service/federation-server.d.ts

@@ -0,0 +1,20 @@
+import { Layer } from "effect";
+import type { Ontology } from "../ontology.js";
+import { OntologyBackend } from "./runtime-contract.js";
+import { createFederationProvider } from "./federation-provider.js";
+import { type BrowserRevision, federationStatus } from "./federation-status.js";
+import type { TokenVerifier } from "./authentication.js";
+export declare const FEDERATION_PATH = "/api/ontology/federation";
+/** OIDC is a login protocol here. Cloud tokens never become workspace bearer credentials. */
+export declare function federationLayer(config: {
+    issuer: string;
+    clientId: string;
+    environment?: string;
+    deploymentId?: string;
+    manifestDigest?: string;
+} | undefined, verify: TokenVerifier, options?: {
+    browserRevision?: BrowserRevision;
+    ontology?: Ontology;
+    provider?: ReturnType<typeof createFederationProvider>;
+    status?: typeof federationStatus;
+}): Layer.Layer<never, never, OntologyBackend | import("effect/unstable/http/HttpRouter").HttpRouter>;

package/dist/service/federation-server.js

@@ -0,0 +1,249 @@
+import { randomBytes } from "node:crypto";
+import { Effect, Layer } from "effect";
+import { HttpServerResponse } from "effect/unstable/http";
+import { use as registerRoutes } from "effect/unstable/http/HttpRouter";
+import { FEDERATION_TOKEN_PREFIX, federationDigest } from "../runtime/federation.js";
+import { OntologyBackend } from "./runtime-contract.js";
+import { createFederationProvider } from "./federation-provider.js";
+import { browserRevisionAdmitted, browserRevisionObservation, browserSessionAdmission, federationStatus, } from "./federation-status.js";
+export const FEDERATION_PATH = "/api/ontology/federation";
+const opaque = (prefix) => `${prefix}${randomBytes(32).toString("base64url")}`;
+const json = (body, status = 200) => HttpServerResponse.jsonUnsafe(body, {
+    status,
+    headers: { "cache-control": "no-store" },
+});
+/** OIDC is a login protocol here. Cloud tokens never become workspace bearer credentials. */
+export function federationLayer(config, verify, options = {}) {
+    const browser = options.ontology?.signIn.browser;
+    if (browser && !browser.methods.includes("segmentstream")) {
+        config = undefined;
+    }
+    const configuration = () => json({
+        version: 1,
+        ...(browser ? { manifest_digest: options.ontology.manifest.hash } : {}),
+        browser: browser
+            ? {
+                methods: browser.methods,
+                primary: browser.primary,
+                auto_redirect: browser.autoRedirect,
+                ...(browser.local ? { local: browser.local } : {}),
+            }
+            : null,
+    });
+    if (!config) {
+        return browser
+            ? registerRoutes((router) => router.add("GET", `${FEDERATION_PATH}/configuration`, () => Effect.succeed(configuration())))
+            : Layer.empty;
+    }
+    const provider = options.provider ?? createFederationProvider(config);
+    const checkStatus = options.status ?? federationStatus;
+    const matches = (session) => browser
+        ? browserSessionAdmission(session, config)
+        : Promise.resolve({
+            active: session.issuer === config.issuer && session.clientId === config.clientId,
+        });
+    return registerRoutes((router) => Effect.gen(function* () {
+        const backend = yield* OntologyBackend;
+        const store = backend.federation;
+        if (!store) {
+            return;
+        }
+        const respond = (effect) => Effect.gen(function* () {
+            const revision = options.browserRevision
+                ? yield* Effect.promise(() => browserRevisionObservation(options.browserRevision))
+                : { active: true };
+            const revisionValid = () => browserRevisionAdmitted(revision);
+            if (!revisionValid()) {
+                return json({ error: "access_revoked" }, 401);
+            }
+            const response = yield* effect(revisionValid);
+            return revisionValid() ? response : json({ error: "access_revoked" }, 401);
+        }).pipe(Effect.catchCause((cause) => Effect.logError("ontology.federation.failed", cause).pipe(Effect.as(json({ error: "sign_in_failed" }, 401)))));
+        yield* router.add("GET", `${FEDERATION_PATH}/configuration`, () => Effect.succeed(json({
+            version: 1,
+            ...(browser ? { manifest_digest: options.ontology.manifest.hash } : {}),
+            browser: browser
+                ? {
+                    methods: browser.methods,
+                    primary: browser.primary,
+                    auto_redirect: browser.autoRedirect,
+                    ...(browser.local ? { local: browser.local } : {}),
+                }
+                : null,
+        })));
+        yield* router.add("POST", `${FEDERATION_PATH}/exchange`, (request) => respond((revisionValid) => Effect.gen(function* () {
+            const body = yield* request.json;
+            const input = body;
+            if (!input ||
+                (input.intent !== undefined && input.intent !== "link") ||
+                ![input.code, input.verifier, input.redirectUri, input.nonce].every((value) => typeof value === "string" && value.length > 0 && value.length <= 4096)) {
+                return json({ error: "invalid_request" }, 400);
+            }
+            let linkUserId;
+            if (input.intent === "link") {
+                if (browser && !browser.methods.includes("email")) {
+                    return json({ error: "method_disabled" }, 403);
+                }
+                if (typeof input.proof !== "string" ||
+                    !input.proof ||
+                    input.proof.length > 16384 ||
+                    !store.emailIdentity) {
+                    return json({ error: "workspace_login_required" }, 403);
+                }
+                const verified = yield* Effect.promise(() => verify(input.proof));
+                if (verified.status !== "valid" || verified.identity.provider !== "neon-auth") {
+                    return json({ error: "workspace_login_required" }, 403);
+                }
+                const proof = yield* store.emailIdentity(verified.identity.subject);
+                if (!proof || proof.kind !== "member") {
+                    return json({ error: "workspace_login_required" }, 403);
+                }
+                linkUserId = proof.id;
+            }
+            const identity = yield* Effect.promise(() => provider.exchange(input));
+            if (!(yield* Effect.promise(() => checkStatus(identity)))) {
+                return json({ error: "access_revoked" }, 401);
+            }
+            if (browser && !identity.sessionId) {
+                return json({ error: "session_grant_required" }, 401);
+            }
+            let principal = yield* store.identity(identity.issuer, identity.subject);
+            const known = store.bindingExists
+                ? yield* store.bindingExists(identity.issuer, identity.subject)
+                : principal !== undefined;
+            if (known && !principal) {
+                return json({ error: "access_denied" }, 403);
+            }
+            if (linkUserId && principal && principal.id !== linkUserId) {
+                return json({ error: "identity_conflict" }, 403);
+            }
+            if (!linkUserId && !known && browser && store.enroll) {
+                if (!identity.email) {
+                    return json({ error: "verified_email_required" }, 403);
+                }
+                if (!revisionValid()) {
+                    return json({ error: "access_revoked" }, 401);
+                }
+                principal = yield* store.enroll(identity);
+            }
+            const signedIn = principal !== undefined && linkUserId === undefined;
+            const token = opaque(signedIn ? FEDERATION_TOKEN_PREFIX : "ssfl_");
+            if (!revisionValid()) {
+                return json({ error: "access_revoked" }, 401);
+            }
+            yield* store.save({
+                ...identity,
+                hash: federationDigest(token),
+                userId: signedIn ? principal.id : null,
+                ...(linkUserId ? { linkUserId } : {}),
+                expiresAt: Date.now() + (signedIn ? 30 * 86400_000 : 600_000),
+            });
+            return json({
+                status: signedIn ? "signed_in" : "proof_required",
+                token,
+                ...(!signedIn
+                    ? {
+                        identity: {
+                            id: identity.subject,
+                            ...(identity.email ? { email: identity.email } : {}),
+                            ...(identity.name ? { name: identity.name } : {}),
+                        },
+                    }
+                    : {}),
+                ...(linkUserId ? { linkUserId } : {}),
+            });
+        })));
+        yield* router.add("POST", `${FEDERATION_PATH}/link`, (request) => respond((revisionValid) => Effect.gen(function* () {
+            const body = yield* request.json;
+            const pending = body?.pending;
+            const authorization = request.headers.authorization;
+            if (typeof pending !== "string" ||
+                !pending.startsWith("ssfl_") ||
+                !authorization?.startsWith("Bearer ")) {
+                return json({ error: "workspace_login_required" }, 403);
+            }
+            const verified = yield* Effect.promise(() => verify(authorization.slice(7)));
+            if (verified.status !== "valid" || verified.identity.provider !== "neon-auth") {
+                return json({ error: "workspace_login_required" }, 403);
+            }
+            const session = yield* store.consumePending(federationDigest(pending));
+            const admission = session
+                ? yield* Effect.promise(() => matches(session))
+                : { active: false };
+            if (!session ||
+                session.userId ||
+                !browserRevisionAdmitted(admission) ||
+                !(yield* Effect.promise(() => checkStatus(session)))) {
+                return json({ error: "link_rejected" }, 403);
+            }
+            const proof = session.linkUserId !== undefined
+                ? store.emailIdentity
+                    ? yield* store.emailIdentity(verified.identity.subject)
+                    : undefined
+                : yield* backend.resolvePrincipal(verified.identity);
+            if (!proof ||
+                proof.kind !== "member" ||
+                (session.linkUserId !== undefined && session.linkUserId !== proof.id) ||
+                !revisionValid() ||
+                !browserRevisionAdmitted(admission)) {
+                return json({ error: "link_rejected" }, 403);
+            }
+            const linked = yield* store.link(session.issuer, session.subject, proof.id);
+            if (!linked) {
+                return json({ error: "identity_conflict" }, 403);
+            }
+            const token = opaque(FEDERATION_TOKEN_PREFIX);
+            if (!revisionValid() || !browserRevisionAdmitted(admission)) {
+                return json({ error: "link_rejected" }, 403);
+            }
+            yield* store.save({
+                ...session,
+                hash: federationDigest(token),
+                userId: linked.id,
+                expiresAt: Date.now() + 30 * 86400_000,
+            });
+            return json({ status: "signed_in", token });
+        })));
+        yield* router.add("POST", `${FEDERATION_PATH}/link-email`, (request) => respond((revisionValid) => Effect.gen(function* () {
+            if (!browser?.methods.includes("email") || !store.linkEmail) {
+                return json({ error: "method_disabled" }, 403);
+            }
+            const authorization = request.headers.authorization;
+            const body = yield* request.json;
+            const proofToken = body?.proof;
+            if (!authorization?.startsWith(`Bearer ${FEDERATION_TOKEN_PREFIX}`) ||
+                typeof proofToken !== "string") {
+                return json({ error: "invalid_request" }, 400);
+            }
+            const session = yield* store.read(federationDigest(authorization.slice(7)));
+            const admission = session
+                ? yield* Effect.promise(() => matches(session))
+                : { active: false };
+            if (!session?.userId ||
+                !browserRevisionAdmitted(admission) ||
+                !(yield* Effect.promise(() => checkStatus(session)))) {
+                return json({ error: "access_revoked" }, 401);
+            }
+            const proof = yield* Effect.promise(() => verify(proofToken));
+            if (proof.status !== "valid" || proof.identity.provider !== "neon-auth") {
+                return json({ error: "workspace_login_required" }, 403);
+            }
+            if (!revisionValid() || !browserRevisionAdmitted(admission)) {
+                return json({ error: "access_revoked" }, 401);
+            }
+            const linked = yield* store.linkEmail(session.userId, proof.identity.subject, proof.identity.email);
+            return linked === "email_identity_mismatch"
+                ? json({ error: "email_identity_mismatch" }, 403)
+                : linked
+                    ? json({ status: "linked" })
+                    : json({ error: "identity_conflict" }, 403);
+        })));
+        yield* router.add("POST", `${FEDERATION_PATH}/logout`, (request) => respond(() => Effect.gen(function* () {
+            const authorization = request.headers.authorization;
+            if (authorization?.startsWith(`Bearer ${FEDERATION_TOKEN_PREFIX}`)) {
+                yield* store.remove(federationDigest(authorization.slice(7)));
+            }
+            return json({ signed_out: true });
+        })));
+    }));
+}

package/dist/service/federation-status.d.ts

@@ -0,0 +1,40 @@
+import type { FederationSession } from "../runtime/federation.js";
+/** Freshness starts before I/O. Failure after expiry is closed, with no stale-while-revalidate. */
+export declare function createFederationStatus(options?: {
+    fetch?: typeof fetch;
+    now?: () => number;
+}): (session: Pick<FederationSession, "issuer" | "clientId" | "consentId" | "generation" | "sessionId">) => Promise<boolean>;
+export declare const federationStatus: (session: Pick<FederationSession, "issuer" | "clientId" | "consentId" | "generation" | "sessionId">) => Promise<boolean>;
+export interface BrowserRevision {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly manifestDigest: string;
+    readonly deploymentId?: string;
+}
+export interface BrowserRevisionObservation {
+    readonly active: boolean;
+    readonly compatibleManifestDigest?: string;
+    readonly validUntil?: number;
+}
+/** Recheck retained evidence immediately before admission, after any awaited verification. */
+export declare function browserRevisionAdmitted(observation: BrowserRevisionObservation, now?: number): boolean;
+/** The active source revision fences every explicit browser method, including old Neon URLs. */
+export declare function createBrowserRevisionObservation(options?: {
+    fetch?: typeof fetch;
+    now?: () => number;
+}): (revision: BrowserRevision) => Promise<BrowserRevisionObservation>;
+export declare function createBrowserRevisionStatus(options?: {
+    fetch?: typeof fetch;
+    now?: () => number;
+}): (revision: BrowserRevision) => Promise<boolean>;
+export declare const browserRevisionStatus: (revision: BrowserRevision) => Promise<boolean>;
+export declare const browserRevisionObservation: (revision: BrowserRevision) => Promise<BrowserRevisionObservation>;
+/** A persisted session keeps its signed source identity; Cloud alone may admit a predecessor. */
+export declare function browserSessionAdmission(session: Pick<FederationSession, "issuer" | "clientId" | "environment" | "deploymentId" | "manifestDigest" | "sessionId">, current: {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly environment?: string;
+    readonly deploymentId?: string;
+    readonly manifestDigest?: string;
+}, observe?: (revision: BrowserRevision) => Promise<BrowserRevisionObservation>, now?: () => number): Promise<BrowserRevisionObservation>;
+export declare function browserSessionMatches(...args: Parameters<typeof browserSessionAdmission>): Promise<boolean>;

package/dist/service/federation-status.js

@@ -0,0 +1,151 @@
+/** Freshness starts before I/O. Failure after expiry is closed, with no stale-while-revalidate. */
+export function createFederationStatus(options = {}) {
+    const cache = new Map();
+    const now = options.now ?? Date.now;
+    return (session) => {
+        const key = JSON.stringify([
+            session.issuer,
+            session.clientId,
+            session.consentId,
+            session.generation,
+            session.sessionId,
+        ]);
+        const cached = cache.get(key);
+        if (cached && now() - cached.checkedAt < 55_000) {
+            return cached.value;
+        }
+        const checkedAt = now();
+        const value = (async () => {
+            const endpoint = new URL(`${session.issuer}/status`);
+            endpoint.search = new URLSearchParams({
+                client_id: session.clientId,
+                generation: String(session.generation),
+                consent: session.consentId,
+                ...(session.sessionId === undefined ? {} : { session: session.sessionId }),
+            }).toString();
+            const response = await (options.fetch ?? fetch)(endpoint, {
+                cache: "no-store",
+                redirect: "error",
+                signal: AbortSignal.timeout(4000),
+            });
+            const body = (await response.json());
+            if (!response.ok) {
+                throw new Error(`Cloud OIDC status check failed with HTTP ${response.status}`);
+            }
+            // Transport/protocol failures reach the authentication boundary's operator diagnostics.
+            return body.active === true && now() - checkedAt < 55_000;
+        })();
+        if (cache.size >= 1000) {
+            cache.delete(cache.keys().next().value);
+        }
+        cache.set(key, { checkedAt, value });
+        return value;
+    };
+}
+export const federationStatus = createFederationStatus();
+/** Recheck retained evidence immediately before admission, after any awaited verification. */
+export function browserRevisionAdmitted(observation, now = Date.now()) {
+    return (observation.active && (observation.validUntil === undefined || now < observation.validUntil));
+}
+/** The active source revision fences every explicit browser method, including old Neon URLs. */
+export function createBrowserRevisionObservation(options = {}) {
+    // Share concurrent I/O only. A positive answer must never extend Cloud's cutover deadline.
+    const inFlight = new Map();
+    const now = options.now ?? Date.now;
+    return async (revision) => {
+        const key = JSON.stringify([
+            revision.issuer,
+            revision.clientId,
+            revision.manifestDigest,
+            revision.deploymentId,
+        ]);
+        let value = inFlight.get(key);
+        if (!value) {
+            value = (async () => {
+                const endpoint = new URL(`${revision.issuer}/revision-status`);
+                endpoint.search = new URLSearchParams({
+                    client_id: revision.clientId,
+                    manifest_digest: revision.manifestDigest,
+                    ...(revision.deploymentId ? { deployment_id: revision.deploymentId } : {}),
+                }).toString();
+                const response = await (options.fetch ?? fetch)(endpoint, {
+                    redirect: "error",
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(4000),
+                });
+                if (!response.ok) {
+                    throw new Error(`Browser authentication revision check failed with HTTP ${response.status}`);
+                }
+                const body = (await response.json());
+                const validUntil = body.valid_until;
+                const compatible = body.compatible_manifest_digest;
+                if (body.active !== true ||
+                    (validUntil !== undefined &&
+                        (typeof validUntil !== "number" || !Number.isFinite(validUntil))) ||
+                    (compatible !== undefined &&
+                        (typeof compatible !== "string" || !compatible || validUntil === undefined))) {
+                    return { active: false };
+                }
+                return {
+                    active: true,
+                    ...(typeof compatible === "string" ? { compatibleManifestDigest: compatible } : {}),
+                    ...(typeof validUntil === "number" ? { validUntil } : {}),
+                };
+            })();
+            if (inFlight.size >= 1000) {
+                inFlight.delete(inFlight.keys().next().value);
+            }
+            inFlight.set(key, value);
+            const entry = value;
+            const forget = () => {
+                if (inFlight.get(key) === entry) {
+                    inFlight.delete(key);
+                }
+            };
+            void value.then(forget, forget);
+        }
+        const observed = await value;
+        return observed.validUntil !== undefined && now() >= observed.validUntil
+            ? { active: false }
+            : observed;
+    };
+}
+export function createBrowserRevisionStatus(options = {}) {
+    const observe = createBrowserRevisionObservation(options);
+    return async (revision) => (await observe(revision)).active;
+}
+export const browserRevisionStatus = createBrowserRevisionStatus();
+export const browserRevisionObservation = createBrowserRevisionObservation();
+/** A persisted session keeps its signed source identity; Cloud alone may admit a predecessor. */
+export async function browserSessionAdmission(session, current, observe = browserRevisionObservation, now = Date.now) {
+    if (!session.sessionId ||
+        session.issuer !== current.issuer ||
+        session.environment !== current.environment) {
+        return { active: false };
+    }
+    if (session.clientId === current.clientId &&
+        session.deploymentId === current.deploymentId &&
+        session.manifestDigest === current.manifestDigest) {
+        return { active: true };
+    }
+    if (!session.deploymentId ||
+        !session.manifestDigest ||
+        !current.deploymentId ||
+        !current.manifestDigest) {
+        return { active: false };
+    }
+    const source = await observe({
+        issuer: session.issuer,
+        clientId: session.clientId,
+        deploymentId: session.deploymentId,
+        manifestDigest: session.manifestDigest,
+    });
+    return source.validUntil !== undefined &&
+        browserRevisionAdmitted(source, now()) &&
+        source.compatibleManifestDigest === current.manifestDigest
+        ? source
+        : { active: false };
+}
+export async function browserSessionMatches(...args) {
+    return browserRevisionAdmitted(await browserSessionAdmission(...args), (args[3] ?? Date.now)());
+}

package/dist/service/handlers.d.ts

@@ -0,0 +1,18 @@
+import type { ChatDeliveryFactory } from "./chat/delivery.js";
+import { Layer } from "effect";
+import { type HttpApiGroup } from "effect/unstable/httpapi";
+import type { MetricQueries } from "./metric-query.js";
+import { type BuiltApi } from "./api.js";
+import type { AfterCommitHook } from "./config.js";
+import type { ReplicationKick } from "./replication.js";
+import type { DeploymentObservation } from "../deployment.js";
+import type { ConnectionTransportFactory } from "./connections.js";
+import { type RateLimit } from "./rate-limit.js";
+import { OntologyBackend } from "./runtime-contract.js";
+/**
+ * Sign-in checks one client may make per minute. A person checks once per sign-in, a few times at
+ * most; the limit slows down anyone testing addresses to learn who the app's members are.
+ */
+export declare const SIGN_IN_CHECK_LIMIT: RateLimit;
+/** The handlers of every group of the API; they require {@link OntologyBackend}. */
+export declare function handlersLayer(built: BuiltApi, hooks: ReadonlyMap<string, AfterCommitHook>, connections: ConnectionTransportFactory, replicate: ReplicationKick, metricQueries: MetricQueries, chatDelivery: ChatDeliveryFactory | undefined, deployment?: DeploymentObservation): Layer.Layer<HttpApiGroup.Service<"ontology", string>, never, OntologyBackend>;